Xlight FTP Server < 3.9.5 Pre-Auth Stack Buffer Overflow via SSH GCM Cipher

published 2026-07-29 3 mo ago modified 2026-10-23 16 d ago also EUVD-2026-50399

cvss: 8.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.0%; EPSS 1.0% chance of exploitation in 30 days, percentile 63%
public exploits: 0; none known

Xlight FTP Server before 3.9.5 contains a pre-authentication stack buffer overflow vulnerability that allows unauthenticated attackers to corrupt stack memory by sending malformed SSH packets when a GCM cipher is negotiated. Attackers can craft packets with an unvalidated length field passed directly to the GCM decrypt function, overwriting the stack cookie and return address to potentially achieve remote code execution before any authentication occurs.

Patch / fix

fixed in 1

Xlight Xlight FTP Server 3.9.5

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 3 mo ago (2026-07-29)

Exploit prediction

1.03% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	9.2	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA	3.1	8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA	4.0	9.2	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

Xlight Xlight FTP Server

Classification

Weakness

CWE-121 Stack-based Buffer Overflow

References

xlightftpd.com /whatsnew.htm
release-notes
vulncheck.com /advisories/xlight-ftp-server-pre-auth-stack-buffer-overflow-via-ssh-gcm-cipher
third-party-advisory

Sources

CVE List CVE-2026-67192
NVD CVE-2026-67192

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary